#Op It’s time

A new player, Union of Hacktivists

Until April 2015, all hacking activities are mainly connected to the “Union of Underground Myanmar Hackers (UGMH)” and Blink Hacker Group (BHG). The first group formed by a collation of smaller hacking groups including Myanmar Hacker Unite4m (MHU) had a main focus on Bangladeshi and Indonesian Muslim sites while Blink Hacker Group remained compulsively obsessed with defacing online Myanmar media including Irrawaddy, Mizzima, DVB, Eleven Media, etc.

To our surprise, the scene changed months before the Elections of November 2015. A totally unknown group with the name “The Union of Hacktivists” became notorious after the defacement of the Burmese media site Elevenmyanmar.com in April 2015 and their operation “#Op Fucking Media” that specifically targeted independent online media in Burma.

The Union of Hacktivists became increasingly active during October 2015, just one month before the General elections in Burma of the 8th November 2015. During one week, the group defaced half a dozen Burmese media sites.

During the days before and after the November elections we discovered the Union of Hacktivists is in fact an undercover organization operating from military premises that has adopted the aesthetics of other hacker groups active in Myanmar to run operations to undermine the work of online media in the country.

Attacks against the sites during before and during the elections were not effective but malicious activity continued and the 19th of November 2015, the Union of Hacktivists (ဟက္ကာမ်ားသမဂၢ) targeted the 7Day Daily company Information Matrix and the 25th of November 2015, the IELTS in Myanmar.

After weeks monitoring malicious activities in both the Democratic Voices of Burma and the Irrawaddy’s websites, we tracked the attack to a military operated network. In the same network and behind two different proxy-firewalls (BlueCoat ProxySG devices), runs traffic from the Defense Services Computer Directorate (DSCD), the Defense Services Command and General Staff College (DSCGSC), the Defense Services Science and Technological Research Center (DSSRTC) and the National Defense College (NDC).

New intrusions attempts took place against the sites during the weeks after the elections. After fine tuning the monitoring, during the first week of December of 2015 we could fully attribute the attacks to someone behind the proxy of the Defense Services Computer Directorate (DSCD).

A detailed look into the network infrastructure of the Military shows that several institutions, while physically located in Kalaw, Nay Pyi Daw or Pyin U Lwin, share a common public IP address but are operating behind different BlueCoat devices and Proxies that we managed to fingerprint.

DSTADSCGSCCommand and General Staff CollegeDSTADSA

Union of Hacktivists
Days after the Union of Hacktivists is calling for volunteers to join.

Using Anonymous as a cover channel

The modus operandi of the Union of Hacktivists reassembles the same methods and type of messages in other forums from Gtone, messages trying to recruit new talents from communities of young hackers.

Gtone will later steer the hacking operations towards local online media.

Gtone also hides his operations behind several Facebook groups including the Anonymous Myanmar. He copies the aesthetics of Anonymous and runs the Official Anonymous Myanmar Hacker page in Facebook.

Anonymous Myanmar Facebook Logo

In December 2014, a new group with the name “Myanmar Black Hats” has emerged and it is the latest attempt to recruit more actors. The domain was registered the 26th of November 2014 by Creatigon.Another undercover hacking group created by the military

Fuck the Fucking All Burmese Media Bourgeois! We are Everywhere! We are watching you! We Hacked You, to Know the Power of Kachin Country & Kachin Cyber Army. Do not you support to establish Kachin country? We 'll Fight all of you .. Again .. Again .. Again & Again!

Fake KCA defacement

Very soon after the defacements, the Myanmar Times published the 10th of December 2012 advertising that Eleven Media was hacked by the Kachin Cyber Army. After studying all the documented attacks associated to the KCA, we have reasons to believe that those defacements are fake and have been constructed to serve the government political agenda of conflict escalation.